CVE-2022-22778

HIGH

TIBCO BusinessConnect Trading Community Management < 6.1.1 - Unauthenticated Cross-Site Request Forgery

Title source: llm

Description

The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://www.tibco.com/services/support/advisories

Vendor Advisory x_refsource_confirm

https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-18-2022-tibco-bctcm-cve-2022-22778

Scores

CVSS v3 8.8

EPSS 0.0021

EPSS Percentile 43.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

tibco/businessconnect_trading_community_management < 6.1.1

Published May 18, 2022

Tracked Since Feb 18, 2026